New PIPEDA Vendor Guidance: What Holds Up in Due Diligence
Canada's new PIPEDA third-party guidance sets the questions your buyers will ask. Here is the security evidence that holds up in vendor due diligence.
7 min
• Blog Archive
2026 Articles
16 articles from 2026
Browse by year:
How a CREST Pentest Report Closes the Enterprise Security Review
Why a pentest report from a CREST-accredited firm, sent before procurement asks, shortens enterprise security reviews and the sales cycle behind them.
7 min
• What to Budget For Next Year: Penetration Testing, Tabletop Exercises, and Compliance
How PCI DSS, SOC 2 and ISO 27001 set pentest cadence and scope, where a gamified tabletop exercise fits as a line item, and a self-check for next year.
6 min
• What Actually Drives Penetration Testing Pricing (And Why There's No Industry-Wide Framework)
Why penetration testing has no standard price list, and how to compare quotes by scope type, environment size, testing depth and post-test deliverables.
11 min
• How Often Should You Pentest? Time Testing to Releases, Not the Calendar
Time pentests to releases and compliance windows instead of a fixed calendar, and set retest timing from finding severity and your remediation SLAs.
6 min
• The Vulnerabilities I Keep Finding in AI-Generated Code
Patterns seen in AI-generated code in production penetration tests: business logic gaps, authorization, input validation and error handling.
7 min
• How to Tell Your Board What Your Pentest Actually Found
How to turn a pentest report into a board briefing: put severity in business language, report remediation status honestly and use a ten-minute structure.
4 min
• The Compliance Trap: Why Compliance Doesn't Guarantee Safety
Audits such as SOC 2, ISO 27001 and PCI DSS measure process. What the PowerSchool breach shows and where penetration testing fits alongside compliance.
4 min
• Finding Closed Is Not Finding Fixed: Who Actually Owns Remediation After a Pentest
Who has the authority to call a pentest finding fixed, what remediation documentation should show and why a retest is the real confirmation.
5 min
• How to Get Budget Approved for a Gamified Tabletop Exercise
Build the business case for a gamified tabletop exercise: benchmark the cost, answer skeptical executives and win budget approval.
8 min
• What is a Gamified Tabletop Exercise?
What a gamified tabletop exercise is, why teams run one, and how it shows where your documented incident response plan breaks down under pressure.
8 min
• How to prepare for a penetration test
How to prepare for a penetration test: timeframe, scope, test environment, credentials, an emergency contact and what to expect in the final report.
6 min
• What to expect during a pentest?
What happens during a penetration test, from scoping and preparation to active testing and the final report, so you know what to expect at each stage.
6 min
• What Is Penetration Testing? A Plain-Language Guide for First-Timers
Penetration testing explained in plain language: what it is, how it works, and what to expect from scope to final report.
5 min
• What Building Security in Canada Teaches You About Enterprise Expectations: A Practitioner's View
How Canadian regulatory pressure shapes enterprise security expectations, and what a provider serving Canada, the U.S. and EU learns about buyer scrutiny.
5 min
• A Tale of Two Penetration Tests
Two organizations came to us for a penetration test with very different questions. What each approach shows about how companies buy security.
8 min
•